Data Retention &
Deletion Policy

Purpose

This Data Retention & Deletion Policy explains how long Servyn AI retains different categories of data, when and how data is deleted, and how you can request deletion or export. It applies to all Customers, trial users, and individual Data Principals whose data is processed through the platform.

This Policy complies with DPDPA 2023 S.8(7) (data must not be retained beyond the period necessary for the stated purpose) and the legal retention obligations under Indian law.

Retention Schedule

Data Type	Retention Period	Deletion Trigger	Legal Basis
All active ERP data (jobs, invoices, customers, AMC, employees)	Duration of active subscription + 30 days	Day 31 after subscription ends or cancellation confirmed	Contractual necessity
Employee records (attendance, leave, payroll)	Duration of active subscription + 30 days	Day 31 after subscription ends	Contractual necessity
User account data (name, email, role, password hash)	Duration of subscription + 30 days	Day 31 after subscription ends or user is deactivated	Contractual necessity
Trial account data	Up to 7 days from trial end	Day 7 after trial expiry	Consent
GST invoices & tax records	5 years minimum from end of financial year	See Section 3 — Legal Hold	CGST Act 2017 S.36; mandatory legal retention
Income tax related financial records	7 years from relevant assessment year	See Section 3 — Legal Hold	Income Tax Act 1961 S.44AA; mandatory legal retention
Payroll & employment records (for companies)	8 years	See Section 3 — Legal Hold	Companies Act 2013; mandatory legal retention
Support communications	12 months from last interaction	Auto-purged after 12 months	Legitimate interest
Login & audit logs	90 days rolling	Auto-rolled after 90 days	Legitimate interest — security
Uploaded media files	Duration of subscription + 30 days	Day 31 after subscription ends	Contractual necessity
Database backups	30-day rolling cycle	Overwritten on 30-day cycle	Legitimate interest — disaster recovery

Financial Data Legal Hold — Important

The following financial data will be retained in a secure, isolated legal archive even after subscription cancellation, for the periods required by law:

Record Type	Minimum Retention	Governing Law
GST invoices, tax invoices, credit/debit notes	5 years from end of financial year	CGST Act 2017, Section 36
Books of accounts, financial statements	7 years from relevant assessment year	Income Tax Act 1961, Section 44AA
Payroll records & employment registers (for companies)	8 years	Companies Act 2013, Section 128
Payment gateway transaction records	5 years	Payment and Settlement Systems Act 2007; RBI guidelines

Data held under a Legal Hold is:

• Stored in an isolated, encrypted archive with strictly controlled access
• Not used for any business, analytical, or commercial purpose
• Only accessible to Servyn AI when required to respond to a lawful government request, tax audit, or legal proceeding
• Permanently deleted as soon as the statutory retention period expires

We will notify you in writing of any data held under a Legal Hold and the expected date of permanent deletion.

Deletion Process

When a deletion event is triggered:

1. Day 0: Deletion event triggered (subscription cancellation confirmed, trial expiry, or explicit deletion request received)
2. Day 0: Warning email sent to company admin explaining the 30-day window and how to request a data export
3. Day 27: Reminder email sent with 3 days' notice before permanent deletion
4. Day 30: All non-legally-held Customer Data is permanently deleted from the active database
5. Within 30-day backup cycle: Deleted data is also purged from all backup copies as they rotate
6. Within 5 business days of request: Deletion confirmation email sent upon request

Data Export

You may request a full export of your company data at any time during your active subscription, or within the 30-day post-cancellation window.

To request an export:

1. Email founder@servynai.in with subject: "Data Export Request — [Your Company Name]"
2. Include your registered company name and admin email address
3. Servyn AI will prepare and deliver the export within 5 business days

The export will include all your operational data in CSV and/or JSON format. Exported files are password-protected and delivered via a secure, time-limited download link.

Right to Erasure

Under DPDPA 2023 S.12, individuals have the right to request erasure of their personal data. We handle such requests as follows:

• Individual employee requests: Contact your company admin first. The admin can deactivate your account. Servyn AI will follow the standard retention schedule from the point of deactivation.
• Company admin requests for full account deletion: Email us. We will process full account deletion within 10 business days, subject to legal hold obligations.
• Limitations: We cannot erase data subject to a Legal Hold (Section 3). We will inform you of any such limitation in writing.

Submit erasure requests to: founder@servynai.in — Subject: "Data Erasure Request"

Backups

Servyn AI maintains automated database backups on a 30-day rolling cycle, hosted on AWS ap-south-1 (Mumbai, India) via Supabase.

• All backups are encrypted at rest (AES-256) and in transit (TLS)
• Access to backups is restricted to Servyn AI's founding team
• Backups are used exclusively for disaster recovery — not for any analytical or commercial purpose
• When data is deleted from the active database, it is automatically excluded from all subsequent backup cycles and purged from existing backups within the 30-day rotation
• Legal Hold data in backups follows the extended retention periods in Section 3

Contact